CVE-2026-73033 - Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php

Back Back to CVE browser

HIGH

Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php

Published Aug 10, 2026

7.0

HIGH

CVSS 4.0

EPSS 0.93%

Description

Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission() method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscan_integrity parameter. Attackers can manipulate the unsanitized file path concatenated with ABSPATH to traverse outside the WordPress installation directory and invoke unlink() on sensitive files such as wp-config.php and .htaccess, causing site outage or enabling malicious reinstallation.

Affected products

Vendor Sucuri Product Sucuri-Wordpress-Plugin Default
affected
- Version
  0
  Status
  affected
  Constraints
  <=2.7.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sucuri

Sucuri-Wordpress-Plugin

affected

Version	Status	Constraints
0	affected	<=2.7.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-55803
Advisory
https://github.com/Sucuri/sucuri-wordpress-plugin/issues/217
exploittechnical-descriptionissue-tracking
https://www.vulncheck.com/advisories/sucuri-wordpress-plugin-path-traversal-via-integrity-lib-php
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-55803		Advisory
https://github.com/Sucuri/sucuri-wordpress-plugin/issues/217		exploittechnical-descriptionissue-tracking
https://www.vulncheck.com/advisories/sucuri-wordpress-plugin-path-traversal-via-integrity-lib-php		third-party-advisory